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Abstract — In this paper correspondence between experimental 
data for packet delay and two theoretical types of distribution 
is investigated. Statistical tests have shown that only exponential 
distribution can be used for the description of packet delays in 
global network. Precision experimental data to within microsec- 
onds are gathered by means of the RIPE Test Box. Statistical 
verification of hypothesis has shown that distribution parameters 
remain constants during 500 second intervals at least. In paper 
cumulative distribution function and generating function for 
packet delay in network are in an explicit form written down, 
the algorithm of search of parameters of distribution is resulted. 

I. Introduction 

The special area of the control theory, named networked 
control systems in which transfers as environment of operating 
signals were used computer networks, has arisen in the late 
nineties of the XX-th century [ 1 8 1 . Originally, as the network 
environment of control systems local networks [8 1 which differ 
high-speed data transfer and in the minimum percent of packet 
loss were used. 

The networked control systems in which as the handle 
environment the global network Internet is used, is extremely 
complicated because of random character of distribution of 
packet delay and their big absolute values ifTUl , |fT31 , ifTTl . 
However till now, results of the advanced network researches 
are not used in the control theory and algorithms on their basis 
are not created. The present project assumes introduction of 
new network decisions in networked control systems. 

Except classical problems of the control theory, there is 
requirement of management and monitoring of network pro- 
cesses. For example, for video transfer over networks TCP/IP 
networks the important parameter is the available bandwidth 
between two hosts (4). For problems of routing it is neces- 
sary to know throughput between routers. Special network 
emulators are applied to modeling of the majority of network 
processes, for example, INET/OMNET ++ ITBl 

Now numerous programs which imitate transmission of 
packets through TCP/IP protocol network are created. In a 
basis of operation of all emulators position that the type of 
delay distribution is unknown is occupied. The purpose of our 
research consists in that not only to define delay type, but also 
to find generating function for the traffic emulators. 

For the decision of problems of the networked control 
systems on the basis of stack TCP/IP it is more convenient to 
use the process approach to the control theory, based on idea of 
existence of some universal functions of control. The purpose 
of our research is the finding of this function for network 
components. In the modern theory of computer networks 



there were many utilities working with a network delay, there 
is a progress in studying and modeling of transmitting of 
packets. Our problem consists in trying to describe process 
of a network delay of management packets and to show 
ways of practical calculation of all parameters entering into 
corresponding distribution functions Q. 

By transmission of control signals through TCP/IP network, 
the separate packets of the controlling data flow transferring 
the information are supplied non-uniformly, and the part of 
packets in general is lost by transmission on a network and 
does not reach a target. For rise of efficiency of control 
algorithms it is necessary to reduce to a minimum of packets 
delay and their variation, and also percent of packet loss. 
Similar algorithms are used for transmission voice and video 
streams, in grid systems, at control of robust systems, in 
network computer games, etc. 

At first it would be desirable to result the brightest research 
on a distribution type for network delay. To understand, about 
what there is a speech in described papers, will give definitions 
of notations used in them: 

• Round-trip time (RTT) time is the time required for 
a packet to travel from the testing host to a remote 
computer that receives the packet and retransmits it back 
to the source. 

• The One-Way Delay (OWD) value is calculated between 
two synchronized points A and B of an IP network, and 
it is the time in seconds that a packet spends in travelling 
across the IP network from A to B. 

In particular, Elteto and Molnar [6] have spent measure- 
ments of round-trip delay in the Ericsson Corporate Network, 
complex analysis of the received data has allowed to build 
the supposition about distribution type for network delay. The 
main finding of their research is that the round-trip delay can 
be well approximated by a truncated normal distribution. 

Konstantina Papagiannaki et al |[T2l in the research have 
measured and have analyzed packet delay between two adja- 
cent routers in the core network. On the basis of the received 
measurements, they have made the supposition about the 
factors influencing occurrence of delay, and very big delays 
which cannot be explained in the way of batch processing in 
routers on algorithm FIFO have been noticed. 

Recently, fulfilling a series of operations on measurement 
of an available bandwidth 1131 . we have installed that for a 
type definition of delay distribution we should research only 
a variable part of delay while its most part remains constant. 
This fact also has served as a starting point of our operation. 



II. Premises for model 



III. Experimental search 



In 1999 Downey [5| for the first time has detected linear 
dependence of the minimum possible round trip time on the 
size of transferred packets. In 2004 precise experiments by 
Choi et al Qj, Hohn et al ifTTI proved that the minimum fixed 
delay component D* lxed (W) for a packet of size W is a linear 
(or precisely, an affine) function of its size, 



D flxed {W) = WJ2 l / C i + 6 ' 



(1) 



1=1 



where C, is each link of capacity of h hops and 5i is 
propagation delay. To validate this assumption, they check the 
minimum delay of packets of the same size for three path, and 
plot the minimum delay against the packet size. 

Let D(W) represents the one way delay (point-to-point 
delay) of a packet. Here we refer to it as the minimum 
path transit time for the given packet size W, denoted by 
Df txed (W) = min D(W). With the fixed delay component 
Df lxed (W) identified, we can now subtract it from the point- 
to-point delay of each packet to study the variable delay 
component d var . The variable delay component of the packet, 
d var , is given by 



D(W) = D fzxed {W) + d var 
Computed minimal delay D^ lxed {W) is 

D^ xed (W) = D mm + W/C, 



(2) 



(3) 



where C — (W2 — W\)/(D 2 — D{) is end-to-end available 
bandwidth and it is searched, comparing average time of 
packet delay of the different sizes W 2 and W\ |13|. Here 
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lim D flxed (W) 



(4) 



The value D m i n is related to the distance between the sites 
(i.e. propagation delay) and per-packet router processing time 
at each hop along the path between the sites J2J, 0. This 
value represents as the minimum delay D m i n for which the 
very small package can be transmitted on a network from one 
point in another. 

The minimal delay [13] of datagram transmission D m i n 
may be calculated as 



D„ 



W 2 D^ ixed (W 1 ) - W 1 D^ xed {W 2 ) 
W 2 - Wi 



(5) 



This value as well as the methods of its measurement has a 
important significance in applied tasks of control theory |18|. 
The second significant question of networking control theory is 
the distribution type for variable delay component d var which 
should be studied in rest of paper. To know the expression for 
this parameter we may easy calculate the duration of buffer 
for streaming application on receiving side. 



In order to determine distribution type for a variable de- 
lay component d var we should run considerable quantity 
of measurements between various hosts in the Internet. The 
basic problem of experimental testing is the precise of delay 
measurements that is necessary for accurate result. Similar 
measurements demand, at least, microsecond precision for 
delay measurements; we are reaching such accuracy with help 
of RIPE Test Box mechanism Q, fl4l . In order to prepare 
the experiments three Test Boxes have been installed in 
Moscow, Samara and Rostov on Don during 2006-2008 years 
in framework of RFBR grant 06-07-89074. Each RIPE Test 
Box represents a server under management of an FreeBSD 
operating system with the GPS receiver connected to it. 

Characteristic times of investigated processes (a packet 
delay, jitter) have the order from 10 ms to 1 sec, there- 
fore is enough to use system hours of a RIPE Test Box 
for their reliable measurement. At the first stage experiment 
between tt01.ripe.net (RIPE NCC at AMS-IX, Amsterdam), 
ttl43.ripe.net (Samara, SSAU), ttl7.ripe.net (Bologna) and 
tt74.ripe.net (Melbourne) have been made which include pre- 
cision measurement of packet delay with accuracy 2-12 fis. 
Testing results are available via telnet to corresponding RIPE 
Test Box on port 9142. It is important to come and write 
down simultaneously the data on both ends of the investigated 
connection. 

On the basis of the received data set it is easy to construct 
a cumulative distribution function for network delay D: 



F(D) = P(x < D) 



(6) 



dx.D > D n 



For initial comparison truncated normal and exponential 
distributions have been chosen, expressions for which are 
written down. 

For truncated normal distribution it is possible to select 
following approximation: 

!0,D < D min ; 
y/2A ? f (g ~ Amn) 2 ' 

a J CXP \ 2<r* 
D min 

(7) 

where 

® Dav D rn i n (8) 

is the difference between average network delay D av (W) = 
E[D(W)} and minimum delay D min (W). 

It should be noted that all statistical data has been gathered 
by us for the fixed size of a packets W. By default for RIPE 
Test Box it equals to 100 bytes. In Section [V] we update a 
cumulative distribution function F(D, W) taking into account 
the packets size W. 

The alternative type of allocation which will be checked on 
correspondence is an exponential distribution, expression for 
which is written below. 

f 0,D < D min 

F(D) = l (9) 
v ' \l-exp{-\(D-D min )},D>D min 
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bolonia 
tt01=Htl7 


100 
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0.97 
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tt01=Mtl43 


100 


0.87 


0.98 
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samara 
tt01=Mtl43 


1024 


0.99 


0.99 
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melburn 
tt01=>tt74 


100 


0.66 


0.97 



TABLE I 

Precise measurements 
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Fig. 1. Experimental (dash), normal (dash-dot) and exponential (dot) CDFs, 
precise testing. Direction: tt01=>ttl43, W =100 bytes 



Fig. 2. Experimental (dash), normal (dash-dot) and exponential (dot) CDFs, 
precise testing. Direction: tt01=>ttl43, W =1024 bytes 
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TABLE II 

ping MEASUREMENTS 



where 

A = l/(D av - D min ) (10) 

is reciprocal to the difference between average network delay 
D av (W) = E[D(W)} and minimum delay D mm (W). 

For initial check of conformity to distribution type two 
methods will be used: calculation of Pearson correlation coeffi- 
cient and a graphic method. We will designate as K nor correla- 
tion coefficient between experimental and normal distributions 
then K exp is correlation coefficient between experimental and 
exponential distributions. 

The obtained data is shown in Table [I] where the column 
host corresponds to a direction between two RIPE Test Boxes, 
and the column W specifies in the size of a testing packet. 

Except correlation coefficients it is possible to compare 
graphics representation of cumulative distribution functions 
(CDF), showing all three functions on one plot. On the uniform 
graphics (see Figures [T] [2} dash line selects an experimental 
curve, dot-dash curve corresponds to normal allocation. In dot 
style the exponential distribution is painted. 

The plots constructed in Figures 1 and 2, represent depen- 
dence of CDF on delay of a packet on a site from Amsterdam 
to Samara (tt01=>ttl43). The first plot describes testing of a 
network by packages in the 100 bytes size, the second plot 
corresponds to packages in the size of 1024 bytes. Time on 
axis is measured in milliseconds. 

All experiments resulted above testify that the preferable 
type of distribution describing packet delay in a global net- 
work is an exponential distribution. Thus, as have shown 
our researches, the random variable of packet delay between 
two network points is arranged on an exponential low with 
the parameter calculated from experimental values under the 



Equation ( [T0| . 

However, not each investigator who is engaged in the con- 
trol theory has the equipment for the precision measurements, 
similarly RIPE Test Boxes. Therefore in this part it would be 
desirable to present technique which uses the data of well- 
known utilities and doesn't demand the expensive equipment. 

For testing it is possible to use the utility ping as it is 
the most widespread resource for verification of connection 
quality in TCP/IP networks. Let's mark only that this utility 
measures round-trip time, instead of one way delay. 

The data received with help of ping has the millisecond 
precision that is exact enough to judge delay distribution. 
The utility ping allows testing connections between points 
AIST - New Zealand (tt47.ripe.net), Volgatelekom - Australia 
(tt74.ripe.net) and SSAU-Melbourn (tt74.ripe.net). As remote 
hosts were used servers of RIPE measurement system, AIST, 
Volgatelecom (VT), Infolada and SSAU is local Internet 
Service Providers from Samara region, Russia. Processing 
the obtained data on the above described algorithm, we have 
received the results presented in the Table [IT] 

The evident illustration is resulted in definition of distribu- 
tion type in Figure [3]|5] 

It should be noted that the utility ping allows finding 
automatically values of variables D av and D m i n (see Eqns. ^ 
and (|9]l) which completely define the distribution form, both 
normal and exponential types. It is enough to give sequence 
from 20 packets to obtain the given values with split-hair 
accuracy, sufficient for the description of processes of the 
control theory. 
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Fig. 3. Experimental (dash), normal (dash-dot) and exponential (dot) CDFs, 
precise testing. Direction: Samara=>Holland, W =32 bytes 
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Fig. 4. Experimental (dash), normal (dash-dot) and exponential (dot) CDFs, 
precise testing. Direction: Infolada=>Athens, W =32 bytes 



IV. Statistical hypothesis testing 

The verification executed in the previous section about 
conformity of distribution type has preliminary character and 
isn't strict. In this section for check of distribution type 
Pearson's chi-square test will be used. 

For processing some data sets from 2000 to 2500 values the 
delays collected with interval in 2 seconds have been used. 
This data divides into intervals in 50, 100, 250, 500, 1000 and 
2000 values and was tested on Pearson. Testing results could 
be found in Tables [InJ [TV] 

At construction of these Tables following designations were 
used: 

• Dimension of observations N (number of measurements) 

• n is the number of cells. All observations N are di- 
vided among n cells according Sturges' rule n = (1 + 
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Fig. 5. Experimental (dash), normal (dash-dot) and exponential (dot) CDFs, 
precise testing. Direction: SSAU=> Australia, W =1064 bytes 



3.22 IgN) + 1 

• t is the value of the test-statistic 

• Xo. 95.n-i i s me theoretical value of threshold of hypoth- 
esis acceptance 

If t < Xo 95 n-i men hypothesis about corresponding type of 
distribution is accepted, differently hypothesis is rejected. 

In the beginning we will check up on conformity to expo- 
nential distribution the data, reception by means of RIPE Test 
Box, see Table [nil 

From Table [ill] follows that within 500 second intervals 
(250 measurements) the packet delay is distributed on the 
exponential law. 

The data received with RIPE Test Box, was checked also on 



conformity to the truncated normal distribution, see Table IV 



Pearson's chi-square test allows rejecting hypothesis about 
the truncated normal type of distribution for the description of 
process of packet delay. 

V. Distribution Type for Delay and Generating 
Function for Traffic Emulator 

In real the Internet processes the size of transferred packages 
can vary, therefore the cumulative distribution function should 
be updated. For each size of a packet W there is the minimum 
time Df lxed (W) defined by the Eq. (|). 

Then, the final cumulative distribution function F(D, W) is 

0, D < D rnin + W/C 

F(D,W) = (l - exp {-A(D - D min - W/C)} , (11) 



where 



D> Dr, 



W/C 



(12) 



is reciprocal to the difference between average network delay 
D av (W) = E[D{W)} and minimum delay D mm (W) and C 
is end-to-end capacity. 

It is important to notice that the data on the delay, re- 
ceived with use of packages of various length, comprises the 
additional variable component caused network jitter j (delay 
variation) 0). Therefore, the best the controlling algorithm 
will form packages of the identical size. If we use the utility 
ping for delay definition in it there is a special key for resizing 
of a testing package (— I in Windows, — s in Linux). 

Our model has one more wide application except tasks of 
the control theory. Results of our operation can be applied at 
writing of emulators of the traffic in a global network |16|. 
Till now it was considered that the type of delay distribution is 
unknown, and traffic emulators used own generating functions 
for delay generation. On the basis of the type of delay found 
us (see Eqn. ( [TT) ) it is possible to write generating function 



D = D„ 



W/C - (1/A) ln(l - F(D, W)) 



(13) 



In this equation content distribution function (CDF) 
F(D, W) can be set the generator of random numbers. The 
received numbers will give values of delay for network packet 
of the different size. We will notice once again that in real 
networks these values can be calculated according to the 
specilised utility. 
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TABLE III 

Verification of exponential distribution, Samara-Amsterdam, (tt143=>tt01), packet size 100 bytes 
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TABLE IV 

Verification of truncated normal distribution, Samara-Amsterdam, (tt143=>tt01), packet size 1024 bytes 



VI. Conclusion 

In the present work for the description of process of 
the packet delay in a global networks it has been chosen 
exponential distribution. In comparison with truncated normal 
distribution it has shown the best correlation with experimental 
results. Unlike the truncated normal distribution it passes 
check by statistical methods. 

Experimental data were gathered by means of the precision 
RIPE measuring system to within microseconds, and also by 
means of the standard utility ping. This utility measures round- 
trip time to within milliseconds. During small periods about 
several minutes when it is possible to consider conditions of 
transmission on a TCP/IP network invariable, such approach 
gives correlations from above 0.99. At change of network 
conditions the elementary ping testing by a series from 20 
packets will allow to change exponential distribution parame- 
ters instantly. 

We write in an explicit form of cumulative distribution 
functions for normal and exponential distribution of delay. 
Generating function for packet delay has been found in real 
networks which can be used in emulators of the traffic of a 
global network. 
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